5

Recently I discovered that some pings sent to me were giving a TTL error. When someone pings my computer, it shows a different TTL value for every packet.

For example, ping.eu shows that:

--- PING 78.188.216.242 (78.188.216.242) 56(84) bytes of data. ---
64 bytes from 78.188.216.242: icmp_req=1 ttl=112 time=78.7 ms
64 bytes from 78.188.216.242: icmp_req=2 ttl=17 time=78.8 ms
64 bytes from 78.188.216.242: icmp_req=3 ttl=206 time=78.7 ms
64 bytes from 78.188.216.242: icmp_req=4 ttl=212 time=78.7 ms

--- 78.188.216.242 ping statistics ---
packets transmitted  4 
received  4 
packet loss  0 % 
time  3002 ms 

--- Round Trip Time (rtt) ---
min  78.734 ms 
avg  78.782 ms 
max  78.861 ms 
mdev  0.050 ms

(And sometimes I see request timed out and TTL expired errors as well.)

As you can see, every packet has a different TTL value. Is that a problem? If it is, is it caused by my network configuration, or is it caused by my ISP? And what can I do in this situation?

If it matters, I use a WRT54GH home router with ZyXEL ADLS bridge modem, connecting three Windows computers. You can try to ping me at my IP address, 78.188.216.242.

HopelessN00b
  • 53,795
  • 33
  • 135
  • 209
Burak Tamtürk
  • 163
  • 1
  • 7

2 Answers2

6

I got similar results pinging your IP address from the US.

When I pinged 81.212.77.58, the next hop upstream from you, which I presume is your ISP's equipment, I got back a TTL of 243 every time. This is obviously wrong.

The next hop upstream from that acted reasonably, with a TTL of 54 every time.

My strong suspicion based on these results is that your ISP is mangling the packets.

Michael Hampton
  • 244,070
  • 43
  • 506
  • 972
  • when i tracert to google, first host is 78.188.216.1 and the second is 81.212.77.57. But when you tracert to me, is the last hop is 81.212.77.58? If so, different host handle the connection every time? Am i wrong? – Burak Tamtürk Jul 24 '12 at 21:14
  • 81.212.77.57 and 81.212.77.58 are a point-to-point link between two routers. When you traceroute from one side (e.g. US to Turkey) you see responses from one network interface, and when you traceroute from the other side (e.g. Turkey to US) you see responses from the other network interface. So, 81.212.77.58 and 78.188.216.1 are two different interfaces on the same router. – Michael Hampton Jul 24 '12 at 21:20
  • Ok, when i ping 81.212.77.57 ttl is 62, when i ping 81.212.77.58 ttl is 254. Which is wrong? When i tracert to 81.212.77.57 there is total 3 hops, when i tracert to 81.212.77.58 there is 2 hops. So i assuming the problem is caused by ISP, and its too bad to me, because my isp will not (can not) understant and solve problem. Doesnt matter whatever the problem is they say this every time "reboot your modem", then "take a speedtest, if speed is not lower than xmbit, there is no problem". – Burak Tamtürk Jul 24 '12 at 21:30
  • 2
    254 is definitely wrong, so you've identified the router and network interface that has the problem. Good luck finding the correct person at your ISP to report the problem to. (He exists, but technical support is meant to prevent you from talking to him...) – Michael Hampton Jul 24 '12 at 21:40
1

Providing your not pinging yourself the TTLs that come back are the TTL values of the received ping packet. There is little you can do to manipulate that.

Matthew Ife
  • 23,357
  • 3
  • 55
  • 72
  • 1
    Is it caused by my modem, or isp? – Burak Tamtürk Jul 24 '12 at 20:52
  • Typically the ttl is reduced by one on each hop. What you see here is traffic coming back to you taking different routes. I'd imagine someone's router along the route is flapping and sending packets crazy routes. - The bit I'm not sure about is why both routes give the same latency. Perhaps it's the same route but a device in the middle isn't altering the ttl correctly. – Sirex Jul 24 '12 at 20:57
  • I know that, but i think its worst thing can be done to my network. I just think my network is unstable. A computer at Ankara access my computer without problem. But a virtual server from netherlands, can't proxy http request to me (it proxy, but sometimes very slow response time). – Burak Tamtürk Jul 24 '12 at 21:01